| Age | Commit message (Collapse) | Author |
|---|
|
NetBSD has no native wg(4) kernel module and no wg-quick; pi0/pi1 use
pkgsrc wireguard-go + wg instead, with a custom /etc/rc.d/wireguard
script since there's nothing to hook into. This required:
- Generating a stripped config (no Address/DNS lines) for `wg setconf`,
which rejects wg-quick extensions with "Line unrecognized".
- Generating the rc.d script itself, with one route add/delete pair per
peer AllowedIPs prefix, since wg-quick normally manages those routes
automatically and wg only handles the crypto routing decision.
- Per-host wg_bin override (doas resets PATH to exclude /usr/pkg/bin) and
full-path chown in the NetBSD install path (doas PATH also excludes
/usr/sbin, where chown lives on NetBSD -- caught by actually running
--install against pi0 before fixing it here).
Verified: --generate output for pi0/pi1 matches the hand-written configs
byte-for-byte (same keys, same routes); --install deployed cleanly to
both with correct root:wheel ownership and live WireGuard handshakes;
non-NetBSD hosts (f0, r0, blowfish, earth) produce byte-identical output
to before this change.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
|
wg-quick can only install one default route; giving AllowedIPs=0.0.0.0/0
to both blowfish and fishfinger caused the second peer to silently end up
with allowed-ips:(none) in the running WireGuard config. This made blowfish
a dead peer on earth/pixel7pro/uranus despite active keepalives.
Fix: introduce primary_gateway:true on fishfinger in YAML. In
compute_allowed_ips, only the peer flagged primary_gateway gets 0.0.0.0/0
for roaming+gateway:true clients; all other peers (secondary gateways and
infra) receive their specific /32+/128 IPs only.
Also document in extra_ips_via_gateway why reachable_via must name only
one gateway — WireGuard enforces each AllowedIPs prefix belongs to exactly
one peer, so duplicating earth's IPs across both gateways would cause the
same silent conflict problem.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Adds a reachable_via: fishfinger field to the earth host entry in YAML.
In the Ruby generator, when building a gateway peer's AllowedIPs on
infra hosts, hosts declaring reachable_via: <gateway> now have their
wg0 IPv4/32 and IPv6/128 appended to that gateway peer's AllowedIPs.
This means every infra host that peers with fishfinger now routes
192.168.2.200/32, fd42:beef:cafe:2::200/128 via wg0, so traffic destined
for earth flows fishfinger -> earth without requiring a direct peer block.
The fix survives --generate and --install, replacing the prior manual
one-off edits that were reverted on each regen.
Refactors WireguardConfig#peers into peers + compute_allowed_ips +
roaming_no_gateway_ips + extra_ips_via_gateway (each under ~30 lines).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
|
|
|
|
|
|
- Add freebsd host (192.168.2.202) as roaming client connecting to both gateways
- Add gateway: false option to connect to mesh without routing internet through VPN
- Add /24 subnet mask for FreeBSD IPv4 addresses (required by wg-quick)
- Skip hosts without ssh section during rake install
- Update exclude_peers for f0, f1, f2, r0, r1, r2, earth, pixel7pro
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
|
Enable IPv6 support across all 10 mesh network hosts using ULA addressing
(fd42:beef:cafe:2::/64). Modified generator to output dual-stack configurations:
- Updated address() method to generate multiple Address directives for IPv6
- Modified peers() AllowedIPs to include both IPv4/32 and IPv6/128 addresses
- Maintained backward compatibility for hosts without ipv6 field in YAML
- Roaming clients still route all traffic (0.0.0.0/0, ::/0) through VPN
All hosts now have IPv6 addresses assigned in YAML configuration.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
|
Core changes to wireguardmeshgenerator.rb:
- Add roaming client detection (hosts without 'lan' or 'internet' sections)
- Enable PersistentKeepalive for all roaming client peer connections
- Route all traffic (0.0.0.0/0, ::/0) through VPN for roaming clients
- Add DNS configuration (1.1.1.1, 8.8.8.8) for roaming clients
- Handle CIDR notation in AllowedIPs without adding /32
- Support configurable SSH port per host (default 22, OpenBSD hosts use 2)
YAML configuration changes:
- Add earth roaming client (192.168.2.200, Fedora laptop)
- Add pixel7pro roaming client (192.168.2.201, Android phone)
- Configure client-only architecture via exclude_peers
- Roaming clients connect only to blowfish and fishfinger gateways
- LAN hosts (f0-f2, r0-r2) exclude roaming clients from peering
- Add SSH port 2 for OpenBSD hosts (blowfish, fishfinger)
Dependency updates:
- Add 'rake' gem to Gemfile for task management
- Add 'logger' gem to suppress Ruby 4.0 deprecation warnings
Implementation notes:
- Roaming clients have no fixed 'lan' or 'internet' section
- All-traffic routing enables internet access through VPN gateways
- NAT rules on OpenBSD gateways required for internet access
- WireGuard does not support automatic failover between peers
- Manual reconnection required if active gateway fails
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
